feat: run database migrations on every deploy

- Add init container to run migrations before app starts
- Uses /app/bin/migrate script (runs Towerops.Release.migrate())
- Migrations run once per deployment, before any pods start
- Update CI/CD to set both migrate and towerops container images
- Prevents issues like missing severity column in production

.forgejo/workflows/ci.yml

@@ -215,9 +215,14 @@ jobs:
           kubectl config use-context towerops/towerops:home-cluster-agent
           DEPLOY_TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
           IMAGE_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+          IMAGE_TAG="${{ secrets.REGISTRY_URL }}/graham/towerops-web:main-${IMAGE_SHA}"
+
+          # Update both init container (migrate) and main container
           kubectl set image deployment/towerops \
-            towerops=${{ secrets.REGISTRY_URL }}/graham/towerops-web:main-${IMAGE_SHA} \
+            migrate=${IMAGE_TAG} \
+            towerops=${IMAGE_TAG} \
             -n towerops
+
           kubectl set env deployment/towerops \
             DEPLOY_TIMESTAMP=${DEPLOY_TIMESTAMP} \
             -n towerops

k8s/deployment.yaml

@@ -30,6 +30,54 @@ spec:
         fsGroup: 65534
         seccompProfile:
           type: RuntimeDefault
+      initContainers:
+        - name: migrate
+          image: git.mcintire.me/graham/towerops-web:main-1772735406-025fa88
+          imagePullPolicy: IfNotPresent
+          command: ["/app/bin/migrate"]
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            runAsUser: 65534
+            capabilities:
+              drop:
+                - ALL
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: MIX_ENV
+              value: "prod"
+            - name: DATABASE_SSL
+              value: "true"
+            - name: DATABASE_SSL_VERIFY
+              value: "false"
+            - name: RELEASE_COOKIE
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: RELEASE_COOKIE
+            - name: SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: SECRET_KEY_BASE
+            - name: CLOAK_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: towerops-secrets
+                  key: CLOAK_KEY
+          envFrom:
+            - secretRef:
+                name: towerops-db
+            - secretRef:
+                name: towerops-aws
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "500m"
       containers:
         - name: towerops
           image: git.mcintire.me/graham/towerops-web:main-1772735406-025fa88